3 ms·

It sounds like they weren't in a great financial situation to begin with. Definitely a tragedy to have everything down for three months and to find out afterwar

by duped 5y ago

It sounds like they weren't in a great financial situation to begin with. Definitely a tragedy to have everything down for three months and to find out afterwards that you're not going to have enough money to stick around next year. I wonder what the ransom was and if they paid it. Side note: Planet Money had an interesting segment on insurance claims for things like cyber attacks last week, it's worth giving a listen.

toomuchtodo 5y ago
Cyber insurance premiums are skyrocketing YoY due to ransomware attacks based on conversations with clients. Overall, it’s still a challenge to demonstrate the value of defending against them (reducing attack surface, real backups and data recovery plans, phishing exercises to see who is click happy and what their privileges have access to, etc) to folks who don’t understand the risk this poses. Like driving without insurance, it works until it doesn’t.
- duped 5y ago
  The point they made was some insurance companies consider state sponsored cyber attacks as "acts of war" under their terms and not covered in their policies. It was part of a larger segment on how insurers do or don't insure catastrophic events, like pandemics or war.
- jabroni_salad 5y ago
  Cyber providers are becoming much more savvy and are starting to decide that self-service 'yeah we are totally doing this' self-assessment checklists aren't sufficient. I have around 20 financial institutions on my client list and 11 of them have had their first hands-on penetration test in the past year. A year ago they would just send a laptop with Nessus on it and then sign off on a risk sheet full of the usual llmnr/nebios/kerberoast/smb1 vulns because they didn't know what it meant. Now they will pop your domain administrator and refuse your renewal or jack your rates until you get a followup pentest demonstrating that those vulns have been resolved.
  - toomuchtodo 5y ago
    Seeing the same at fintechs. “We’re compliant.” “Prove it.”
    - anonymousDan 5y ago
      Good!

by duped 5y ago

toomuchtodo 5y ago

Cyber insurance premiums are skyrocketing YoY due to ransomware attacks based on conversations with clients. Overall, it’s still a challenge to demonstrate the value of defending against them (reducing attack surface, real backups and data recovery plans, phishing exercises to see who is click happy and what their privileges have access to, etc) to folks who don’t understand the risk this poses. Like driving without insurance, it works until it doesn’t.

duped 5y ago
The point they made was some insurance companies consider state sponsored cyber attacks as "acts of war" under their terms and not covered in their policies. It was part of a larger segment on how insurers do or don't insure catastrophic events, like pandemics or war.
jabroni_salad 5y ago
Cyber providers are becoming much more savvy and are starting to decide that self-service 'yeah we are totally doing this' self-assessment checklists aren't sufficient. I have around 20 financial institutions on my client list and 11 of them have had their first hands-on penetration test in the past year. A year ago they would just send a laptop with Nessus on it and then sign off on a risk sheet full of the usual llmnr/nebios/kerberoast/smb1 vulns because they didn't know what it meant. Now they will pop your domain administrator and refuse your renewal or jack your rates until you get a followup pentest demonstrating that those vulns have been resolved.
- toomuchtodo 5y ago
  Seeing the same at fintechs. “We’re compliant.” “Prove it.”
  - anonymousDan 5y ago
    Good!